Joomla!Day UK 2011 - Virya Technologies - Ruth Cheesley - Joomla! Security

Joomla!Day UK 2011 - Virya Technologies - Ruth Cheesley - Joomla! Security

• 1.
  Joomla! SecurityRuth Cheesley
• 2.
  Hello, I’m RuthCheesleyfrom Virya TechnologiesFind my social media stuff here!@RCheesley
• 3.
  What do wemean by security?
• 4.
  Why bother?
• 5.
  Where to start?
• 6.
  Security is …Puttingmeasures in place to make unauthorised access more difficultNOT making it impossible
• 7.
  … abalancing actSecurity versus usabilityRisk versus implications
• 8.
  A quick lookat server securityUse a reputable company with Joomla! experienceEnsure they have recommended security settings appliedAsk others if you’re not sure!
• 9.
  Is Joomla! insecure?Itdepends!Often insecurities are due to poor practice by administrators including:Patches not being appliedInsecure extensionsBasic precautions not taken
• 10.
  If you donothing else …Keep Joomla! and extensions up to date
• 11.
  Updating Joomla!ManuallyOne-click (1.6.x+)Akeeba Admin Tools
• 12.
  If you donothing else …Enable Search Engine Friendly (SEF) URL’s
• 13.
  Enable SEF URL’sEnablein global configurationWith or without .htaccessUsing extensions
• 14.
  If you donothing else …Establish a regular backup routine
• 15.
  Establish a backuproutineOn-site backupsOff-site backupsFull or partialAkeeba backup
• 16.
  Other ‘must do’security tasksHide your admin portal (jSecure, Admin Tools)Change your database prefix (manually or using Admin Tools)Change your default Super Admin ID (from #62 in 1.5 or #42 in 1.6/7)
• 17.
  Hide admin portalWhybother?jSecureAkeeba Admin Tools
• 18.
  Change database prefixWhybother?ManuallyAkeeba Admin Tools
• 19.
  Change default adminIDWhy bother?ManuallyAkeeba Admin Tools
• 20.
  Would be goodto do …Web application firewall
• 21.
  Web Application FirewallWhybother?Akeeba Admin Tools
• 22.
  Top Ten TipsKeepJoomla! up to dateKeep extensions up to dateHide admin portalChange database prefixEnsure correct file and folder permissionsDisable default Super AdministratorEnable SEF URL’sEstablish and regularly test backup routineEnsure strong username/password for adminsDo not give out Admin rights freely
• 23.
  Useful linkshttp://www.viryatechnologies.comhttp://www.akeebabackup.comhttp://www.joomlaserviceprovider.comhttp://tinyurl.com/joomlasecuritychecklisthttp://www.ico.gov.uk/
• 24.
  Thank youAny questions?RuthCheesleyVirya [email protected]@RCheesley